skysight-inc/HackerNews huggingface dataset:
They're not competitiors, they're augmenting Dropbox.

From the Dropbox brading guide ( https://www.dropbox.com/developers/reference/branding ):

> you can use the Dropbox logo in marketing material to show your app's Dropbox integration, but it should never be modified and should always refer to our service. If you are using the logo on a website, it should link to https://www.dropbox.com.

So they're allowed to use it, but it must link to the Dropbox website. It doesn't so it's actually violating the guidelines.
One of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration. Scaffolding breaks that rule.

This is really an argument for building authentication and authorization into every app, rather than against scaffolding/ORMs.

As rails doesn't have auth (of both kinds) built in, it doesn't really matter if they offer scaffolding or not - any editing url you make is going to be completely without protection unless you add it. The only thing you'd be adding by not having guessable urls without authentication/authorization is security through obscurity.

So IMHO the lack of auth is really the issue here (and the thing that breaks the rule in your final sentence), rather than the guessable urls.
You might want to make that logo a link to Dropbox since it's required in their guidelines.

https://www.dropbox.com/developers/reference/branding
Meet Chef (Peepcode Screencast)
Such as the four colour theorem? en.wikipedia.org/wiki/Four_colour_theorem
Whoever you are, if you develop an editor, please approach it as a hard real time system.
My own policy is that each situation is unique and in some cases you have to disclose details upfront.

I believe this was one of those cases. The founders of this application were told in the original thread that there were security issues. They didn't respond to the issue and continued allowing users to signup.

Their immediate response should have been to shut down the application with a maintenance page. Their response was instead to tell users to delete their accounts[1].

The other factor here is that because of the type of application users were likely to upload private and sensitive information. This wasn't a simple todo application where users would test it out with fake data, it is a backup application.

The combination of poor initial response, the sensitivity of the data being used and the popularity of the application (being at the top of HN, all over twitter etc.) would lead me to make the exact decision what this blogger did. It was important to notify all users asap that there are problems here, so that they could act on it.

Edit: didn't you do something similar with the Diaspora launch? I think that was another example where it was important to get the vulnerability information out since that first release was popular, users were uploading sensitive information and it was going to take some work to secure the app.

[1] http://news.ycombinator.com/item?id=4619424
Tales of Creation: An interview with Polish Entrepreneur Piotr Biegun
> I don't think I would have been the same engineer I am now had I not used an Apple II+ as my first computer and had I not opened the case and been struck by its absolute elegance - if you are reading this, thanks, Woz, for being our profession's Mozart.

exactly the same here. same first computer
or like 10 years
Dear friends,

I wanted to let you know about a new petition I created on We the People,
a new feature on WhiteHouse.gov, and ask for your support. Will you add your
name to mine? If this petition gets 25,000 signatures by October 07, 2012,
the White House will review it and respond!

We the People allows anyone to create and sign petitions asking the Obama
Administration to take action on a range of issues. If a petition gets
enough support, the Obama Administration will issue an official response.

You can view and sign the petition here:

http://wh.gov/D7Ek
When I did a databases class at a University a few years back, we were given a share on a webserver to run php programs on. Naturally they didn't turn off php error logging, and by default php doesn't report errors to the user. One of the students accidentally wrote an infinite-loop, that generated an error on each iteration, filling up the disk. They never did fix the problem, just deleted the log file both times it occurred.
Jobs wasn't just "a businessman". It's unfortunate you haven't recognized what was so special about him.
I assume it's more about predicting these things before employment begins - someone might look ok at the interview but if you found out traces of drugs in his blood that could be an indicator that this is not their usual state.

Basically we're talking about low-skilled jobs that always have plenty of applicants, filtering a bit too many people isn't that big of a deal when there're still plenty of others remaining afterwards.

It's just a cheap initial filter, as long as it's better than completely arbitrary it's probably beneficial to have.
you and i know that saying "~20" is a random number since you had nothing in place to track it. i'd love to hear how you know it's 20. seriously. tell us.
they'll switch if the editor is good enough
lots of people have switched to SublimeText 2 recently

> will you release your editor's source code

it is already open source
Space is not 'space' (ie, a vaccum) in the solar system, viz

http://en.wikipedia.org/wiki/Interplanetary_medium [1]

At the edge of the sun's impact, there is a transition zone. That transition zone is the subject of this discussion.

Its the 'solar' that makes it a system. the solar system is sort of like the earths atmoshpere, in that regard. At a certain stage there is a transistion into the next level.

This is probably oversimplified, but has the important general idea out on the table. Others can refine as appropriate.

[1] http://news.ycombinator.com/item?id=4619870
What C/C++ repo do you work on (github/bitbucket/etc)?
It's an Ubuntu only tool in the same way that aptitude and dpkg-reconfigure are Ubuntu only tools.

The guide is not claiming to be generic, it's totally fair game to use specific tools imho - especially if they simplify things.
From the Bing cache[1], this is a very short post with some information about the 2nd batch available probably in May:

--8<---

Production Updates

Thanks to all of our backers for pushing Lockitron beyond $1 million in reservations! We’ve been working hard to get back to everyone and we thank you for your patience – we’re bringing in some help so we may answer your questions more quickly.

As we noted yesterday, we have gone far past the original 1,000 Lockitrons we intended to make in the first run. We have been very careful to hold off from selling Lockitron in bulk or wholesale quantity to ensure that individual backers have a chance to get in.

We’ve been in touch with our manufacturing partner, and to ensure that we satisfy all the backers who have supported us already in a timely fashion, we are going to restrict the first batch of Lockitrons to 9,000 units. We’re planning to start shipping batch 1 in March. Once batch 1 fills up, we will open up pre-orders for batch 2. (Edit: batch 1 is now full. We have just opened pre-orders for batch 2.)

It will take us a few days to get a more accurate quote for the new production times, however we don’t anticipate batch 2 to begin shipping before May.

In the coming weeks we will be posting new pictures and videos of the Lockitron mechanism in action. We’ve had a lot of questions about compatibility - of course, if you discover that your door is unfortunately incompatible with Lockitron you can cancel your reservation.

--8<---

[1] http://cc.bingj.com/cache.aspx?q=blog.lockitron.com%2fpost%2...
Push notification to Web client
An AJAX Websocketless approach to web real time notifications
I suspect it is less deployed than SQLite. SQLite gets into things even without network capabilities (e.g. Digital TVs even before they were internet connected for the channel data and the EPG information).

I don't know to what extent the code of the BSD stack remains in Windows but you can bet even if a raw build of Windows doesn't have SQLite embedded somewhere within it (which it might well do) that there are probably multiple software installations with it embedded somewhere.

Would you actually describe the BSD networking code as being deployed in Linux even? I know it is derived from the BSD stack but is it really still the same software.

Zlib and libjpeg as someone else suggests are good suggestions and at least in the races with SQLite.
Apologies. I don't know what I was saying.
Just submitted my first pull request to a C++ repo on Github, and loved the experience.

link https://github.com/duckduckgo/cpp-libface/pull/6

if you would like contributions from someone who predominantly works on objective-c, but wants to learn & dig deeper into c/c++ on weekends, do list them here or ping me!

~B
The Impedance Mismatch is Our Fault
To expand on this a little - the solar wind vapourises part of a comet, forming an atmosphere of sorts called a coma (and the characteristic tail) and this atmosphere glows both by reflecting sunlight and by ionisation. So yes, the cometary nucleus hardly reflects any light, but some light is reflected by the coma and the tail.

(see en.wikipedia.org/wiki/Comet#Coma_and_tail, and just above that for details of light reflection from a cometary nucleus)
No, but it's not reddit either so if you enjoy this site, be constructive with your comments.
This article would have needed to define what it mean by object orientation, and then derive comparisons out of that.

As it stands, it derives conclusions out of nothing. Lets have a clarifying example:

"Object-oriented style is intrinsically less efficient that procedural style. In pure object-oriented style, every routine is supposed to be a (virtual) method. "

I'm pretty darn certain no definition of object orientation I've seen have included virtual methods as part of the definition.

And another:
Polymorphic:
"Economy of large-scale development. Data abstraction and modularization have methodological advantages for code development. Large teams of programmers can negotiate the interfaces to be implemented, and then proceed separately to implement the corresponding pieces of code. Dependencies between pieces of code are minimized, and code can be locally rearranged without fear of global effects. Polymorphism is important for reusing code modularly."

OO:
"Economy of large-scale development. Teams of programmers are often involved in developing class libraries and specializing existing class libraries. Although reuse is a big win of object-oriented languages, it is also the case that these languages have extremely poor modularity properties with respect to class extension and modification. For example, it is easy to override a method that should not be overridden, or to reimplement a class in a way that causes problems in subclasses."

Because all know OO people can't talk each other and define APIs. Also, I can't recall anything in any definition of OO that doesn't allow for creating public interfaces or for that matter prohibiting subclassing of certain methods.

There are so many straw men in this article that it is downright silly.
I commonly see advice to block all ICMP traffic which is even crazier.

I think perhaps the general suspicion of ICMP might be related to things like this http://en.wikipedia.org/wiki/Ping_of_death which are now mostly irrelevant.

Some sort of naive attempt to stop attackers mapping your network too perhaps? It's not exactly a high tech (or effective) means of intrusion detection though.
Is this really a big problem in the States? It just seems a little strange that you appear to take your elections very seriously, and have these huge campaigns etc, but then voter turnout is still considered low?

One solution that occurs to me, simply because this is what used to happen in New Zealand and seemed to work okay, is to hold the election on a Saturday.
So, from what I can readily tell, the UK government has an injunction to stop http://badger-killers.co.uk/ from identifying people involved with the planned cull of badgers in the UK, the supposed intent of which is to prevent the spread of bovine TB. Presumably this is because animal rights activists in the UK have a track record of threatening violence / property damage against people involved in harming animals. Unfortunately this obviously also interferes with the normal and democratic ways in which the cull might be challenged.

FWIW, personally I say screw the the cull and the censorship attempt.
Zero comments even though it's a nice read. I guess everyone suddenly got busy after reaching the paragraph "I wish I knew how to make a website where you could enter a number and have it show you the factorization diagram… maybe eventually." :)
I'm normally pretty skeptical of anti-european sentiments, but in this case I'd be fine with changing the name of the holiday.

Whatever your viewpoint, the exploration of America was pretty complicated and complex, and even just the story of discovery alone is more than Columbus. So open it up, celebrate all the explorers involved. If you've got a story to tell about the first people across the land bridge and down into the continent, let's add that too.

I'd be fine with celebrating the entire story of the exploration of the continent.
Does anyone know why pow uses the .dev tld rather than .test? .test is reserved for local testing. http://en.wikipedia.org/wiki/.test
We have vote-by-mail all over the place now, so there's not much excuse beyond laziness.

In my opinion, if you can't be bothered to put in the minimal effort required now, I'd prefer you didn't vote anyway. I find it difficult to believe you'd be making anything resembling an informed decision.
For me, this is how it happened—I looked at the screenshot and liked how it looked then read the About Brackets blurb to get a good idea. Finally, I found a Mac binary easy enough from the Check It Out part.

Obviously, both these experiences are quite different and both would lead someone to make a certain conclusion about the website. Which is 'correct' then?

Personally, I just hope some of the neat features (Inline CSS editing) appears in Sublime Text 2.
Can Email Be Fixed?
I especially liked the last slide :)
I'd like to think this guy's question wouldn't be actively modded down for not adding to the discussion. Yes, people are supposed to read the rules and such, but I don't find anything wrong about legitimately asking the community for clarifications about standards and expectations, especially when things are border-line.
Indeed, the case of the original commenter seems a little border-line to me - while his point is valid, he comes across as needlessly flippant, and is probably being down-modded more for perceived attitude than actual lack of content. That's a subtle point, and it wouldn't happen on every forum.

That said, I recognize that such meta discussions can be a little derailing, and I don't want to derail this discussion any further - so I'll just leave it at "let's not be a place that discourages new people from asking questions".
At current BTC price (~$12/BTC), mining generates 50 BTC every 10 minutes which translates into $1 value per second, or $1 for 20,000 GHash.
PREfix incorporated analysis to identify likely exit functions. This help cut down false positives in situations like

if (p == NULL)
fatal_error();
*p = 0;

With the inference-based analysis we did in PREfix, if we don't recognize fatal_error() as a function that's likely to exit the program, we'd report a potential NULL pointer on the next line. But we didn't have the source code for fatal_error, how could we possibly know that? Ideally it would be a volatile function but a lot of older code is very sloppy about that. So we employed various heuristics based on the names of the functions (and gave the user an opportunity to tune the results) ... it worked surprisingly well in practice.
Do you miss it? I sometimes do ...
What does RSA stand for? I was on their (SecurID) related site, and checked out the "about" page, but the acronym is never defined.
Want to Learn Git? Start Here
I don't get this. Ensuring that users can't edit/access the profiles of other users is trivial in most frameworks.

It shouldn't be something that slips through testing. If you aren't doing that from the start, something is seriously wrong with how you're building out your application.
Merchee - easy way to collect payment
You know I'd missed that and it's pretty damned useful too!
Call a bike, just one of the available systems, has 7000 bikes acc. to the German Wikipedia entry (source is from 2012). Other national systems are listed, with one quoted as 'starting out as biggest service in 2010', having around 3000.

But let's ignore the numbers for a second (absolute numbers make not a lot of sense anyway, imho. Per capita, maybe?). The real feature is what the headline of this article (wrongly) implied. That you can drive to your friend's place and 'return' the bike in front of his door. Or in front of your favorite pub. Or cinema. No docking stations, period.
Or ckeck the following link to see where the bikes are right now:

http://www.callabike-interaktiv.de/kundenbuchung/process.php...
Ask HN: Is there a SAAS app to do a questions splash page like timedoctor.com
I'm looking to segment my visitors as they enter the website homepage based on their answers to some simple questions.

At the simplest version is could just be one question.

timedoctor.com has the best implementation I have seen, wondering if anyone knows of a service that could do this easily or some more examples of websites doing it.
Buffer Management and Risk Management in the Theory of Constraints
That's a moot point, surely? Everyone who used the app should receive an email from the people behind it very, very quickly - they've all been compromised.

The concern isn't just that RKearney has the keys - it is that anyone could have the keys for anyone on the site. Sending an email to the people whose keys he snagged would help them - but the people whose keys he didn't are still vulnerable too.
fyi, you can see a video of an overview of Brackets here:

http://www.youtube.com/watch?v=2Tk7AUaExBQ&feature=plcp
Hi Siah, I'm sure it's definitely possible depending on her skill set and what size companies she wants to get an intership with.

I think you would have a pretty hard time finding a small startup that would turn down an offer for UX help from someone competent and quick to learn.

I'd suggest she posts some examples of her experience online, in this thread and just approachs small startups with a phone call and offer.
But, you can still do it.

Indeed. Arguably, compilers do it all the time to be able to (safely) do optimizations. Hence static analyzers are usually an extension to an compiler. Frama-C kind of being the exception, using CIL instead of the intermediate representation of a production compiler.
He was a brave Italian explorer. And on this website, Christopher Columbus is a hero. End of story.
This is not a classic security problem causing a "woops" on border line case. This is a failure to implement 101 basic feature.

I know it's hard for people behind this company and they probably invested a lot of time and love to build this product. But we can't just let that pass, for the sake of people that'll use that service next (I mean, with something that basic missed, what next ?).

Please, just get back to learn creating web applications, and see you in a few months for a great product ! (because, yes, the idea was interesting)
oops, close enough :)
Fedora Summer of Open Hardware and Fun Sweepstakes
Finally the prices for the Fedora Linux open hardware started to go out some weeks a go, I got mine last week.
http://orvtech.com/en/general/verano-hardware-libre-fedora-raspberry-pi/
معنى اسم ريناد
معنى اسم ريناد
Good feedback. We just fixed the page to say "Try it" instead of "Check it Out".

=Ryan
ryan@adobe.com
Finally the boards started to ship, I got my Raspberry Pi last week. It is smaller and faster than I was expecting to be hones.
Doesn't work for me on Macbook Air with Ctrl + Click
Mentioned this below as well, but thanks for the feedback on "Check it Out". We just changed it to "Try it" which is a bit clearer.
How I Baited the UK Government to Sue Me for Fun and Profit
Why would you need a SAAS app to do this?
Treehugger's API link is broken
Anything-centrism is "bad" in that it clouds one's ability to be objective. It also impedes empathy.

It's sort of tied to identity. If you do not cling to a specific identity, then it frees you to empathize with a wide range of people. If you say "I am white/asian/tall/rich", then it forms an in-group vs out-group mentality, and obstructs empathy.

For example, does it strike you odd that any land should be deemed "discovered" when there are already inhabiting humans there?
Previous discussions:

http://news.ycombinator.com/item?id=3917637

http://news.ycombinator.com/item?id=4159552
> it's somewhat understandable in the context of a site that unintentionally goes public before it's ready

Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions.

Actually, I may argue that's the very first thing you do once the controller skeleton is set up.
Consumer Reports: iOS6 Maps “Competent Enough”. iPhone 5: Top Smartphone
Android users outraged over Motorola's broken promise
I imagine you were a little unsure of the timeline of things when you commented. Please keep in mind that I wrote this comment before the "never give your info" story and before the website developer commented here on HN. With that in mind I am not sure what point is a moot point?

Do I think the developer should email all of the users? Yes, which is why in my response to the developer's comment about destroying the IAM keys I said "You should think about sending an email to all of your users..."

Do I think that the right thing for rkearney to do is send emails to the people whose information he has? Yes. Is it the best possible scenario? No, but it is better than no notification at all, which at the time was a possibility.
I can deal with web apps that require javascript to function, and I'll happily whitelist apps that I actually want to use. But I don't want to let every asshole with a blog or a newspaper that gets linked from reddit or hackernews execute code on my computer. I think that's a fairly reasonable position.
>Only two of those sentences have anything to do with each other

Err.. I only see two sentences in total. Where is the non sequitur?
>> One of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration.

Which is why my Rails authorization library takes a whitelisting approach.

https://github.com/nathanl/authority#default_methods
otc or would i have to get a prescription?
Would "Hadoop for Haskell" be true as well?
disclaimer : I don't use scaffolding either

Well, scaffolds are not suppose to totally avoid coding. They try to provide what you may write again and again, but you're supposed to take that as a basis, not a final product.
The security problem that was found (now fixed) is less of an issue than the responses they gave afterwards: http://news.ycombinator.com/item?id=4619652
This kind of thing can be handled with doing something like `current_user.accounts.find(params[:id)` instead of `accounts.find(params[:id])`.

If it's not your resource, it's like it doesn't exist for you.
I imagine "dark silicone" would be quite different than "dark silicon".
Install dependencies:

cabal install arithmoi
cabal install diagrams

Copy all the code from the blog post into a file (let's call it factor.hs). At the end of that file, add:

main = defaultMain $ factorDiagram YOUR_NUMBER

Then run:

runhaskell factor.hs -o image.png -w 400